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PATENT 

Attorney Docket No.: A-71400/DJB/MAK 
IN THE UNITED STATES PATENT AND TRADEMARK OFFTCH 
In re application of: 

Timothy Winston HlBBERD 

NATIONAL PHASE ENTRY OF: 

PCT/AUOO/01095 

Serial No.: Not Yet Assigned 

Filing Date: Herewith 

For: An Access Control Method 



Box PCT APPLICATION 
Assistant Commissioner for Patents 
Washington, D.C. 20231 

FIRST PRELIMINARY AMENDMENT 

Sir: 

This Preliminary Amendment accompanies the filing of an application under 35 U.S.C. § 371. 
Prior to examination, please amend the above-identified application as follows: 
IN THE CLAIMS: 

Claims 1-6, 8,9, 11-15 and 1 8 are to remain vinchanged. Please replace claims 7, 10, 16 and 17 
with the following rewritten claims. Replacement claims pages 10-13 are appended hereto and 
incorporate the following rewritten claims. 

7 . An access control method as claimed in claim 2, wherein said at least one 
additional level of access control includes sending commimication 
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U.S. Serial No.: : Not Yet Known 
U.S. Filing Date: Herewith 

software to said apparatus to receive access requests for said service under 
an additional communication protocol. 

1 0. An access control method as claimed in claim 6, wherein said at least one 
additional level of access control includes sending communication 
software to said apparatus to receive access requests for said service under 
an additional communication protocol and wherein said verifying of said 
identification data is a first level of access control, said detecting is a 
second level of access control, and said sending of said communication 
software and execution of said additional communication protocol is a 
third level of access control. 

16. An access control system having components for executing the steps of 
the access control method as claimed in claim 1 . 

17. Access control software stored on a computer system, having code for 
executing the steps of the access control method as claimed in claim 1 . 

IN THE ABSTRACT OF THE DISCLOSURE : 

Please add the following new paragraph and heading at the top of new page 14. New page 14 
is appended hereto and incorporates the following new text. 

ABSTRACT 

An access control method executed by a computer system, including 
applying an access rate limit until a user issuing access requests is verified, a first 
control level involving verifying the user, a second control level applying hack 
program detection tests to the access requests and verifying the user, a third 
control level requiring use of predetermined download software for transmitting 
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the access requests and verifying the user, a foxirth control level blocking access 
to the service on the basis of at least one communications address corresponding 
to the access requests, and invoking the control levels sequentially depending on 
a number of failed attempts to verify the user. 



R E M A R KS 

The foregoing claim amendments are made to obviate the problem of improper 
dependency in the multiple dependent claims which existed in the PCX priority docimient. The 
foregoing abstract of the disclosure was added because no abstract appeared in the PCT priority 
document. Appended hereto at page 4 is a marked-up version of the foregoing amendments in 
which additions to the text are shown with a gray background and deletions with . 



The Commissioner is authorized to charge any additional fees which may be required, or 
credit any overpayment to Deposit Account No. 06-1300 (Our Order No. A-71400/DJB/MAK). 



Respectfully submitted, 

FLEHR, HOHBACH, TEST, 
ALBRITTON & HERBERT LLP 



Dated: 12 March 2002 By:. 

Michael A. KAUFMAhQ^ 
Reg. No. 32,998 
Attorneys for Applicants 

Embarcadero Center - Suite 3400 
San Francisco, California 941 11-41 87 
Tel.: (415)781-1989 
Fax: (415)398-3249 
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VERSION WITH MARKINGS TO SHOW CHANGES MADE 
IN THE CLAIMS : 

Claims 7, 10, 16 and 17 have been amended as follows: 

7. An access control method as claimed in claim 2-or6, wherein said at least one additional 
level of access control includes sending commxmication software to said apparatus to 
receive access requests for said service under an additional communication protocol. 

1 0. An access control method as claimed in claim ?-6, when dependent on claim 6 , w heteiirt 
said at least one additional, Iqvel of access control includes sending communication 
softwi^e tS said apparatus to receive a^ requests for said service urfder & additional 
coraniumcj^ wherein said verifying of said identification data is a first 

level of access control, said detecting is a second level of access control, and said sending 
of said communication software and execution of said additional communication protocol 
is a third level of access control. 

1 6. An access control system having components for executing the steps of the access control 
method as claimed in^laim 1 any on e of the preceding claims . 

1 7. Access control software stored on a computer system, having code for executing the steps 
of the access control method as claimed in any one of c laims 1 to 15 . 

IN THE ABSTRACT OF THE DISCLOSURE : 

The following text has been added as an abstract of the disclosure: 

I ! An access control mfeth^od&ecuted by a compufe, system, includirfg applymg an access 
fate limit until a userassuing access requests is verified, a first control level involving-verifying' 
lfe?,^sej:,jL second controldeyeiiapplying hack pxpgram detection test^j:Q^thevaccess requests and 
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vmifying the user, ajhird control level requiring usejof predetermined download software fb| 
tfansmittini the access requests and verifying the user, a fourth control level blocking access to 
tijip^^ice on the basis of at least one communications address c®T^|onding,to^fee^ access 
rfqu^stsfan din-lok ingtthl control Ifevjelsisecftfei^^ oma It&nfeef failjd^ af em M| 
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CLAIMS: 



10 



15 



20 



25 



An access control method, including: 

receiving an initial access request for a service from a data processing 
apparatus; 

sending unique identification data to said apparatus in response to said initial 
access request; and 

applying a rate limit for verifying access to said service vintil said 
identification data is verified by a user of said apparatus. 

An access control method as claimed in claim 1 , wherein verifying said identification 
data corresponds to a first level of access control, and said method includes applying 
at least one additional level of access control following a predetermined number of 
failed attempts to verify said identification data by said user of said apparatus. 

An access control method as claimed in claim 2, wherein said identification data is 
a random unique security code and said apparatus is sent an unique identification 
number which expires if the security code is not verified within a predetermined 
period of time. 

An access control method as claimed in claim 1, wherein said identification data is 
verified by contacting a device with a known association to said user and said data 
processing apparatus, and having said user provide said identification data using said 
device. 

An access control method as claimed in claim 1, wherein said identification data is 
verified by said user returning said identification data using communication means 
having a known association to said user and said data processing apparatus. 
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5 7. 

10 8. 
9. 

15 

10. 

20 
25 

11. 



An access control method as claimed in claim 2, wherein said at least one additional 
level includes detecting generation of access requests for said service under control 
of a program instead of under control of said user. 

An access control method as claimed in claim 2, wherein said at least one additional 
level of access control includes sending communication software to said apparatus 
to receive access requests for said service under an additional communication 
protocol. 

An access control method as claimed in claim 7, wherein said communication 
software encrypts said access requests. 

An access control method as claimed in claim 2, including invoking sequentially the 
levels of access control depending on the number of failed attempts to verify said 
identification data by said user for access requests over predetermined periods of 
time. 

An access control method as claimed in claim 6, wherein said at least one additional 
level of access control includes sending communication software to said apparatus 
to receive access requests for said service under an additional communication 
protocol and wherein said verifying of said identification data is a first level of access 
control, said detecting is a second level of access control, and said sending of said 
communication software and execution of said additional communication protocol 
is a third level of access control. 

An access control method as claimed in claim 10, wherein said at least on additional 
level of access control includes a fourth level of access control involving blocking all 
access requests by said data processing apparatus. 
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12. An access control method as claimed in claim 1 1, wherein said blocking involves 
denying all access requests that include address data that corresponds to said data 
processing apparatus. 

13. An access control method as claimed in claim 12, wherein the address data is an IP 
address or segment. 

14. An access control method executed by a computer system, including: 

applying an access rate limit until a user issuing access requests is verified; 
a first control level involving verifying said user; 

a second control level applying hack program detection tests to said access 
requests and verifying said user; 

a third control level requiring use of predetermined download software for 
transmitting said access requests and verifying said user; 

a fourth control level blocking access to said service on the basis of at least 
one communications address corresponding to said access requests; and 

invoking said control levels sequentially depending on a number of failed 
attempts to verify said user. 

15. An access control method as claimed in claim 14, wherein said user is verified by 
contacting a device with a known association to said user and said data processing 
apparatus, and having said user provide identification data using said device. 

16. An access control system having components for executing the steps of the access 
control method as claimed in claim 1. 

1 7. Access control software stored on a computer system, having code for executing the 
steps of the access control method as claimed in claim 1 . 
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IS. An access control system, including: 

an access control server for receiving access requests for a service from a data 
processing apparatus, rate limiting access to the server imtil a user of said apparatus 
is verified, and sending to said data processing apparatus unique identification data; 
and 

an IVR for contacting a device having an association with said data processing 
apparatus, issuing a request for said identification data, and providing the data 
received in response to said request to said access server in order to verify said user. 
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ABSTRACT 

An access control method executed by a computer system, including applying an 
access rate limit imtil a user issuing access requests is verified, a first control level involving 

5 verifying the user, a second control level applying hack program detection tests to the access 
requests and verifying the user, a third control level requiring use of predetermined download 
software for transmitting the access requests and verifying the user, a fourth control level 
blocking access to the service on the basis of at least one communications address 
corresponding to the access requests, and invoking the control levels sequentially depending 

10 on a number of failed attempts to verify the user. 
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AN ACCESS C ONTROL METHOD 

The present invention relates to an access control method and to a system and a 
computer program for executing the method. 

5 

One of the perennial problems with providing services over a conmiunications 
network, such as the Internet, is the vulnerability of the system providing the service to 
damage or attack by malicious parties, such as computer hackers. Particularly for service 
provision over the Internet, services, such as information provision and communication 
10 services, may be accessed using scripts or applets which the hackers can attempt to 
replicate in programs to execute excessive access requests for the service. The excessive 
access requests, depending on their nature, can have a variety of effects on the service and 
in some circumstances may cause the service system to collapse. 

15 Detecting a spurious access request or "hack" by a hacker is problematic for any 

service provider and a considerable number of security procedures have been developed to 
try and protect systems from a hack. Hackers however have proven particularly adept at 
being able to circimivent all forms of security procedures and systems which seek to deny 
them access. Given the computing resources and skills which the hacking community 

20 possess, an alternative approach to protecting service provision systems is needed. 

In accordance with the present invention there is provided an access control 
method, including: 

receiving an initial access request for a service from a data processing apparatus; 
25 sending imique identification data to said apparatus in response to said initial 

access request; and 

applying a rate limit for verifying access to said service xmtil said identification 
data is verified by a iiser of said apparatus. 
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The present invention also provides an access control method executed by a 
computer system, including: 

applying an access rate limit until a user issuing access requests is verified; 
a first control level involving verifying said user; 
5 a second control level applying hack program detection tests to said access requests 

and verifying said user; 

a third control level requiring use of predetermined download software for 
transmitting said access requests and verifying said user; 

a fourth control level blocking access to said service on the basis of at least one 
10 communications address corresponding to said access requests; and 

invoking said control levels sequentially depending on a number of failed attempts 
to verify said user. 

The present invention also provides an access control system having components 
1 5 for executing the steps of the method. 

The present invention also provides an access control software stored on a 
computer system, having code for executing the steps of the access control method 

20 The present invention also provides an access control system, including: 

an access control server for receiving access requests for a service from a data 
processing apparatus, rate limiting access to the server until a user of said apparatus is 
verified, and sending to said data processing apparatus xmique identification data; and 

an rVR for contacting a device having an association v^th said data processing 
25 apparatus, issuing a request for said identification data, and providing the data received in 
response to said request to said access server in order to verify said user. 

A preferred embodiment of the present invention is hereinafter described, by way 
of example only, with reference to the accompanying drawings, wherein: 
30 Figvire 1 is a block diagram of a preferred embodiment of an access control system 

connected to a coirmiimications network. 
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An access control system 2, as shown in Figure 1, is used to limit access to and 
protect a service provision system 4. The access control system 2 includes an access 
control server 6 and an interactive voice response system (IVR) 8 which are both 

5 connected to a conmiunications network 30 and to each other. The service system 4 
includes a network server 10 connected to the access server 6, and an application server 12 
connected to the network server 10 and having access to a database 14, The application 
server 12 executes the application to provide a service over the network 30 using the data 
contained in the database 14, The application server 12 gains access to the network 30 via 

10 the netvvork server 10, which may be a web server to handle commimications with the 
network using HTTP, The access server 6 is also able to conununicate with the network 30 
using HTTP and other protocols as necessary. The network 30 includes the Intemet and 
other data and voice delivery networks, such as a public switched telephone network 
(PSTN). Although the servers 6, 10 and 12 and the IVR 8 are shown as separate machines, 

15 the machines can be integrated into one machine or divided into different machines which 
may be distributed and communicate remotely, as will be imderstood by those skilled in 
the art. The latter involves distributing the software components of the servers 6, 10 and 12 
and the IVR 8 amongst the different machines. 

20 The preferred embodiment is described below with reference to the provision of a 

service for executing icon calling, where the application server 12 allows parties (an A 
party) using a data processing apparatus 22 (i.e. a computer) to access directory or 
telephone information concerning another party (the B party) via a web site, and then 
select a call icon on a page of the site to establish a call between the A and B parties. This 

25 involves the application server 12 instructing the network 30 to place a call to a telephone 
16 of the A party and a telephone 18 or 20 of the B party. Further details concerning the 
system required to support the service is provided in the applicant's Australian Patent 
Application No. 19173/97. It will of course be apparent to a skilled addressee that the 
access control method executed by the system 2 described below can be appUed to any 

30 service dehvered over the conmiunications network 30. 
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The access control method is executed by a computer program stored on the access 
control server 6 which communicates with and uses the standard features of the IVR 8, 
such as those provided with the IVRs produced by Periphonics Corporation or Dialogic 
Corporation. Again, the program could be distributed or its processes executed by 
5 dedicated hardware, such as application specific integrated circuits (ASICs), as will be 
understood by those skilled in the art. 

The access control method adopts a different approach to standard security 
methods, in that it is assumed that a hacker using the apparatus 22 will eventually be able 

10 to penetrate any defences, and therefore allows legitimate users to use the system 4 whilst 
it is under attack. The method seeks to limit the number of access requests for the service 
that a hacker can make whilst moving through different control levels as the nxmiber of 
access attempts increase over monitored periods of time. For the icon calling service this 
means limiting the nimiber of prank calls to the same as that which could be made from a 

15 telephone. In other words, this involves rate limiting the number of requests to the same 
level at which call requests could be made from a telephone. Whilst the access limit is in 
place, if a user is not verified, the control levels vsdll move through a second hack detection 
level, a third software download level and a fourth level where access is completely 
blocked for the apparatus 22. 

20 

The data processing apparatus 22 does not provide any unique identification (ID) 
when making an access request to the system 4 which can be used by the access control 
system 2, because an IP address is not unique for a machine 22 which is sharing a proxy 
server with other machines. The method therefore involves creating an ID which is 

25 stamped on the requesting machine 22, Supplementary information delivery strategies 
currently supported by web browsers are cookie files and Secured Sockets Layer (SSL) 
client certificates, but as the availability of client certificates cannot be relied upon, the 
method uses encrypted cookie files, as described below. The A party user or the telephone 
16 of the requesting A party is verified by executing an IVR based security check. The 

30 access control server 6 instructs the IVR 8 to place a call to the telephone 16 designated in 
the call request, and the answering party is asked to enter or divulge a imique code which 
is sent to the machine 22 for display by the access control server 6. The IVR 8 then reports 
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back to the server 6 the code provided using the telephone 16. If the sent and received 
security codes correspond the A party is verified. A rate limit is therefore applied to a 
request having an IP address identifying the machine 22 until this IVR verification has 
been successfully completed. 

5 

The control levels of the access control method described below apply to unverified 
A party numbers from a given IP address. If m or more IP addresses in a segment are 
operating under a control level (m being an integer greater than or equal to 2), an entire IP 
segment, i.e. 256 addresses, is tagged as being in a control level. This provides protection 
10 from a hacker who is cycling through IP addresses in a segment. However, it is not until 
the fourth control level is reached that any IP address or segment blocking occurs, as this is 
potentially serious given that an entire proxy server can be blocked. 

The first control level rate limits access requests so that the service is not denied to 
15 legitimate users and the telephone network is not adversely affected. At this level, the 
access method executes the IVR based verification or validation check, which additionally 
ensures that a computer 22 has been configured correctly. 

When an initial access request is made by the data processing apparatus 22, the 
20 access control system 6 treats this initial access request as a request to register with the 
system 4 and enters a registration validation procedure where a time-limited encrypted 
cookie file encoded with a unique identification number is sent for storage at the machine 
22 and can be used to make one call. When the A party is called for the first time, a 
random unique security code, which in this instance can be text based, is sent for display 
25 on the computer 22 and the IVR 8 is instructed by the access control system 6 to provide a 
prompt for the answering party at the telephone 16 to provide the displayed security code. 
If the security code is entered correctly by the answering party, using DTMF signals 
generated by pressing the buttons on the telephone 16, the time limit in the encrypted 
cookie is cancelled and the number of calls that can be made is changed to unlimited. The 
30 B party is then called on the telephone 18 or 20. Once the security code is verified the 
identification number in the cookie is sent with access requests to the application system 4. 
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The following rate limits are continuously imposed by the access control server 6 
for unverified access requests: 

1 . One concurrent call per machine identification (ID), which is the preferred 
cookie ID rather than a SSL certificate ID. 

2. One concurrent call per A party 16, identified by the A party number. 

3. X concurrent calls per access system 2, which is the number of concurrent 
calls the system 2 is able to support. 

4. One concurrent A party IVR validation procedure for a given IP address or 
segment. 



Access requests or call requests that are received that exceed the above rate limits 
are queued by the access system 2 and a user is presented with their position in the queue 
on a page sent to the web browser of the user's machine 22. The queue position display 
also includes expected time in the queue. A configurable queue size limit applies to each 
15 requesting IP address to prevent overuse of system resouorces. 

The IVR validation check procedure is considered to have failed if an A party call 
is invalidated in that the call enters a ringing state and is abandoned or is connected and 
disconnected without the correct security code being entered into the telephone. This may 
20 occur if a requesting party at the machine 22 enters an A party number which is not theirs 
and a telephone 18 or 20 is rung which is not associated with the machine 22. The person 
who receives this call of course cannot see the displayed security code on the screen of the 
machine 22. Essentially this will be a prank A party call. 

25 The above procedures of the first security level, in particular the rate limit (no. 5) 

regarding concurrent registration and the time limit in the cookie, essentially eliminate any 
prank B party calls and limit the number of prank A party calls to about 2 to 6 per minute. 
The additional protection procedures in the additional control levels below limit the 
niraiber of prank A party calls finlher so that only a few calls can be made. 
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The second access control level is entered if an IP address or segment fails a 
predetermined number, say n, IVR verifications or checks within the last 24 hours. The 
default for n would be 2. The purpose of this level is to execute additional tests on the user 
5 to ensure that a person is controlling the machine 22 and generating the access requests, as 
opposed to an automated program or hack. The tests in this level do not require the user to 
download any software to their computer 22. 

The tests which are executed include the following: 

10 1. A security code is again sent by the access control server 6 to the machine 

22 for display and the IVR 8 instructed to call the A party telephone 16 and 
prompt for the security code to be entered. In this instance, however, the 
security code is presented in a graphic format, i.e. as a bitmap image. This 
will defeat any automated program which is simply looking for the code in 

15 a text based format, and will require any hacker to adjust the hacking 

program to incorporate optical character recognition which is sufficiently 
accurate to extract the security code. 

2. Script or an applet is sent from the access control system to the machine 22 
which is configured to scan the machine to detect an automatic continually 

20 iterative hacking program which may be making the access requests. This 

could be detected by a hacker. 

3. The access control system 6 runs a check procedure to determine whether 
the HTTP requests from the machine 22 include data associated with 
normal use of most browsers, such as Netscape Navigator™ and Microsoft 

25 Intemet Explorer™, and which would not normally be returned by a 

hacking program. 

4. A time based test is executed also by the access control server 6 to detect 
whether the access requests are made faster than would be possible if the 
machine 22 was under human control. 



Other remote checks for program control can also be executed. 
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This control level reduces the attack rate further by forcing a hacker to consider 
how to meet the above tests. This v/ill take some time, believed to be at least 24 hours. 

An IP address or segment at this control level will return to the first control level 
5 within 24 hours if no additional IVR verification failures occur. This will ensure that IP 
addresses randomly assigned by an Internet service provider (ISP) are not blocked simply 
because a hacker has generated a few prank calls. 

The third access control level is entered if an IP address or segment fails o IVR 
10 tests, within 24 hours from the first access request, where o is greater than n. 

In this control level, the access control server 6 sends a prompt to the user's 
machine 22 to download software to the machine 22. When a request for the software is 
received, the access control server 6 sends the software which, when stored on the machine 

15 22, ensures all fixture commimications between the machine 22 and the systems 2 and 4 is 
executed using a secure encrypted conmiunications protocol. This prevents a hacker from 
determining the data passed between the machine 6 and the access control server 6 in all 
fixture communications. It also allows the downloaded software to examine the user's 
machine 22 and send investigative data securely back to the access control system 6 to 

20 detect if a person or program is controlling the machine 22. Again, a hacker, after some 
time, may be able to break the encrypted communication protocol and create a wrapper 
program which mincdcs the downloaded software so that the hack can continue using the 
protocol to access the system 4. Again the time needed to break this control level is 
assumed to be at least 24 hours. 

25 

A machine 22 at the third control level returns to the first control level status within 
48 hours from the initial access request if no additional IVR check failures occur. This is 
done, as mentioned previously, to allow release of IP addresses randomly assigned by 
ISPs. 

30 

An IP address or segment will reach the fourth control level and remain in this state 
until manually cleared by an operator of the system 2 if the IP address or segment has 
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failed o+l IVR checks. This level is used to block the IP address or segment which is 
considered to be unverified. All access requests from the IP address or segment is refused. 
The block is made as close as possible to the machine 22, preferably at a router level, in 
the network 30 to reduce the performance impact of a continuous attack. Accordingly the 
5 attack is reduced further by blocking the IP address or segment as close as possible to 
where the attack originates, which can block an entire proxy server. 

The access control server 6 executes a reverse Domain Name Server (DNS) lookup 
procedure to determine the manager of the domain associated with the IP address or 
10 segment and then sends an e-mail message to the manager advising the block has occurred. 
A copy of the e-mail is also sent to inform the operator of the systems 2 and 4. 

Many modifications will be apparent to those skilled in the art without departing 
from the scope of the present invention as herein described with reference to the 
1 5 accompanying drawing. 
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CLAIMS: 

1 . An access control method, including: 

receiving an initial access request for a service from a data processing 
5 apparatus; 

sending unique identification data to said apparatus in response to said 
initial access request; and 

applying a rate limit for verifying access to said service until said 
identification data is verified by a user of said apparatus. 

10 

2. An access control method as claimed in claim 1, wherein verifying said 
identification data corresponds to a first level of access control, and said method 
includes appljdng at least one additional level of access control following a 
predetermined number of failed attempts to verify said identification data by said 

1 5 user of said apparatus. 

3. An access control method as claimed in claim 2, wherein said identification data is 
a random unique security code and said apparatus is sent an unique identification 
number which expires if the security code is not verified within a predetermined 

20 period of time. 

4. An access control method as claimed in claim 1, wherein said identification data is 
verified by contacting a device with a known association to said user and said data 
processing apparatus, and having said user provide said identification data using 

25 said device. 

5. An access control method as claimed in claim 1, wherein said identification data is 
verified by said user returning said identification data using communication means 
having a known association to said user and said data processing apparatus. 
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6. An access control method as claimed in claim 2, wherein said at least one 
additional level includes detecting generation of access requests for said service 
under control of a program instead of under control of said user. 

5 

7. An access control method as claimed in claim 2 or 6, wherein said at least one 
additional level of access control includes sending communication software to said 
apparatus to receive access requests for said service under an additional 
communication protocol. 

10 

8. An access control method as claimed in claim 7, wherein said communication 
software encrypts said access requests. 

9. An access control method as claimed in claun 2, including invoking sequentially 
15 the levels of access control depending on the number of failed attempts to verify 

said identification data by said user for access requests over predetermined periods 
of time. 

10. An access control method as claimed in claim 7 when dependent on claim 6, 
20 wherein said verifying of said identification data is a first level of access control, 

said detecting is a second level of access control, and said sending of said 
communication software and execution of said additional communication protocol 
is a third level of access control. 

25 11. An access control method as claimed in claim 10, wherein said at least on 
additional level of access control includes a fourth level of access control involving 
blocking all access requests by said data processing apparatus. 



12. 

30 



An access control method as claimed in claim 11, wherein said blocking involves 
denying all access requests that include address data that corresponds to said data 
processing apparatus. 
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13. An access control method as claimed in claim 12, wherein the address data is an IP 
address or segment. 

5 14. An access control method executed by a computer system, including: 

applying an access rate limit until a user issuing access requests is verified; 
a first control level involving verifying said user; 

a second control level applying hack program detection tests to said access 
requests and verifying said user; 
10 a third control level requiring use of predetermined download software for 

transmitting said access requests and verifying said user; 

a fourth control level blocking access to said service on the basis of at least 
one communications address corresponding to said access requests; and 

invoking said control levels sequentially depending on a nimiber of failed 
1 5 attempts to verify said user. 

15. An access control method as claimed in claim 14, wherein said user is verified by 
contacting a device with a known association to said user and said data processing 
apparatus, and having said user provide identification data using said device. 

20 

16. An access control system having components for executing the steps of the access 
control method as claimed in any one of the preceding claims* 

17- Access control software stored on a computer system, having code for executing 
25 the steps of the access control method as claimed in any one of claims 1 to 15. 

18. An access control system, including: 

an access control server for receiving access requests for a service from a 
data processing apparatus, rate limiting access to the server until a user of said 
30 apparatus is verified, and sending to said data processing apparatus unique 

identification data; and 
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an IVR for contacting a device having an association with said data 
processing apparatus, issuing a request for said identification data, and providing 
the data received in response to said request to said access server in order to verify 
said user. 
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